Garuda: open-source coding agent with OS-level sandbox
At a glance
Apache-2.0 terminal/VS Code/Zed agent (ACP) runs commands under Seatbelt/bubblewrap so writes stay in project+temp+caches, network is closed unless allowlisted, edits ask first, team policy can't be loosened by a cloned repo, and an outside hash-chained audit log verifies with /audit verify. This workflow is listed under coding-agent, sandbox, agent-governance, devtools, open-source.
Agents / tools
Garuda, Claude, OpenRouter, Ollama, ACP, Zed, VS Code
Apache-2.0 agent-native sandbox (Linux FUSE/Landlock, macOS APFS clones+Seatbelt) gives agents a confined FS view with unified text diffs, binary markers, and per-task or per-tool-call commit/abort—optional JSON-RPC adapters for Pi and policy for secrets/network.
MIT Python package signs every policy-gated tool call into a hash-chained .tkb file verifiable offline (Python+TS); works across Claude Code, OpenAI Agents, LangChain/LangGraph, MCP and more—agents can edit their own logs but not hide edits when the signer is out of reach.
AGPL self-hostable workspace runs Claude Code, Codex, OpenCode or Pi in isolated sandboxes; hand off from Slack/web/API, attach playbooks/skills/knowledge, approve sensitive actions, and get PRs or files back—positioned as an open Devin alternative.
Stable open-source Azure MCP 3.0 adds Backup, Resilience, SRE Agent, Terraform/Advisor, Monitor/Cosmos/IoT toolsets plus clearer schemas, --learn, and secure-by-default resource creation so Copilot/Cursor/Claude agents can inspect and plan Azure work with predictable contracts.